Hello,
Usually when I use tools to increase a stat I fire an event to the server from a local script where it increases that particular stat.
My main concern is how I should implement a debounce+cooldown system and how to make it work in a way that it prevents exploiters from being able to remove or change the cooldown.
In short, is there a better alternative to adding the debounce+cooldown within the tool.activated in the local script to prevent exploiters from modifying them?
Maybe you can add a Debounce within the Remote Event script and not the Local script.
If I declare a boolean within the serverscript wouldn’t it affect all players as in when a player fires the event it would make that boolean true for all players?
Hmm… Good point. I’m sorry i didn’t take into account more than 1 user.
Add a bool value inside the player instance and check if it is enabled or not. Soo its server sided and its compatible with more than 1 user.
That can work even though I do not really like adding loads of instances within the player.
That is definitely not a good idea, the first rule of network security is “never trust the client” and you are breaking it. Your post doesn’t say particularly what you are trying to do, but lets say you are making a spell. Once the player tries to fire the server to cast a spell, check if the player has a debounce wherever you are storing it in the server. After that change the player’s debounce to false from the server. In order for the server to have less data to process, you can check if the player has a debounce on the client first. An exploiter will be able to bypass this easily but you got your protection on the back-end done.
You can add the player instance into a table then and check if the player instance is inside of that table.
There are multiple ways to approach this such as using a table as Fenix suggested. A debounce on the player is better and easier to check (unless you have a lot of debounces). If you are going to use a table make sure you remove the player’s data when they leave or else it may cause a memory leak.
You can also add the bool values inside of a folder on the player instance, it could make it organized and look better.
Mhm I knew it was not a good idea to do that I just wanted to know what the best way to do it is. I am probably going to make use of a table something like this :
DebounceTbl[plr.Name] = false and change it from there, I will also remove it when the player leaves. Is this okay?
Both you and @Fenix7667 gave correct and helpful answers idk if I can give you both a solution lol.
Alright. Tables are very good and attaching metatables to tables makes them even better and very helpful specifically when handling player data. If you are using a lot of debounces, using tables is the way to go.
@EatSleepCodeRepeat @Fenix7667
I chose to give the solution to one of Eat’s replies as it was more in depth and probably more informative for new players who look at this post.
However, I thank you both for helping. 
Yeah, I agree with you, no problem also.